Zilliqa (ZIL)

ICYMI, @zilliqa has suspended its network due to a vulnerability in its Ledger Hardware App. And to be clear: this is not a @Ledger device/platform issue. The bug is in the official Zilliqa Ledger app implementation. Here’s what happened: A nonce-generation flaw has existed in every version of the official Zilliqa Ledger app since 2019. It affects only native (non-EVM / ZIL1) transactions that use Schnorr signatures over secp256k1. - The app did generate randomness, but it copied the wrong bytes into the nonce buffer. - As a result, the top 64 bits of every ephemeral nonce k were forced to zero. - That means k is biased and always satisfies k < 2^192 (instead of being uniformly random up to ~2^256). Why that matters: Each signature produced with a biased nonce leaks information about the private key. After about 5+ native transactions signed via the Ledger app, an attacker can recover the full private key in seconds using only public, on-chain signature data. The attack uses lattice-reduction techniq

ICYMI, @zilliqa has suspended its network due to a vulnerability in its Ledger Hardware App. And to be clear: this is not a @Ledger device/platform issue. The bug is in the official Zilliqa Ledger app implementation. Here’s what happened: A nonce-generation flaw has existed in every version of the official Zilliqa Ledger app since 2019. It affects only native (non-EVM / ZIL1) transactions that use Schnorr signatures over secp256k1. - The app did generate randomness, but it copied the wrong bytes into the nonce buffer. - As a result, the top 64 bits of every ephemeral nonce k were forced to zero. - That means k is biased and always satisfies k < 2^192 (instead of being uniformly random up to ~2^256). Why that matters: Each signature produced with a biased nonce leaks information about the private key. After about 5+ native transactions signed via the Ledger app, an attacker can recover the full private key in seconds using only public, on-chain signature data. The attack uses lattice-reduction techniq

A crypto wallet app LEAKED people's private keys for SEVEN years, and nobody noticed until last week. The app was Zilliqa's Ledger app, live since 2019. Every signature is supposed to be protected by a random number generated fresh each time. Zilliqa's app copied the wrong bytes, and left part of that random number fixed at zero. That tiny predictable piece was enough. Every transaction you signed gave away a little more of your key. After about five transactions, an attacker can rebuild the entire key in seconds on a normal laptop. This sat undetected in every version of the app for seven years. It was only caught last week when someone started actively draining wallets. The worst part is it can't be reversed. Those weak signatures are on the blockchain forever. Affected users can't even move their funds to safety. The attacker already has the key and can beat them to it. Seven years of a hardware wallet app quietly wrote everyone's private keys into public view.

A crypto wallet app LEAKED people's private keys for SEVEN years, and nobody noticed until last week. The app was Zilliqa's Ledger app, live since 2019. Every signature is supposed to be protected by a random number generated fresh each time. Zilliqa's app copied the wrong bytes, and left part of that random number fixed at zero. That tiny predictable piece was enough. Every transaction you signed gave away a little more of your key. After about five transactions, an attacker can rebuild the entire key in seconds on a normal laptop. This sat undetected in every version of the app for seven years. It was only caught last week when someone started actively draining wallets. The worst part is it can't be reversed. Those weak signatures are on the blockchain forever. Affected users can't even move their funds to safety. The attacker already has the key and can beat them to it. Seven years of a hardware wallet app quietly wrote everyone's private keys into public view.